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We address the problem of the information-disturbance trade-off associated to the estimation of a 
quantum transformation, and show how the extraction of information about the a black box causes 
a perturbation of the corresponding input-output evolution. In the case of a black box performing a 
unitary transformation, randomly distributed according to the invariant measure, we give a complete 
solution of the problem, deriving the optimal trade-off curve and presenting an explicit construction 
of the optimal quantum network. 
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I. INTRODUCTION 

One of the key features of quantum theory is the impos- 
sibility of extracting information from a system without 
producing disturbance on its state, the only exception to 
this rule being the trivial case when the state belongs 
to a set of orthogonal states. A canonical illustration 
of the unavoidable disturbance caused by quantum mea- 
surements is Heisenberg's 7-ray microscope thought ex- 
periment [l|. The impossibility of a non-disturbing ex- 
traction of information is the working principle of quan- 
tum cryptography, whose security relies on the fact that 
any amount of information extracted by the eavesdrop- 
per causes a corresponding amount of disturbance that 
can be detected by the communicating parties. A quanti- 
tative expression of such information-disturbance trade- 
off is a non-trivial issue because there are many different 
ways to quantify "information" and "disturbance" , which 
have been put forward in the literature j2|-[T6|. 

All the scenarios analyzed in the past have one point in 
common: they concern the disturbance produced by mea- 
surements on quantum states. However, one can consider 
other scenarios where the measurements produce a dis- 
turbance on quantum transformations. For example, we 
may have a black box implementing an unknown trans- 
formation belonging to a set {Si}, with the restriction 
that the black box can be used only one time. On the one 
hand, we may try to identify the unknown transforma- 
tion (that is, to find out the index i). On the other hand, 
we may want to use the black box on a variable input 
state. Clearly, in general the two tasks are incompatible: 
In this case there is a trade-off between the amount of 
information that can be extracted about a black box and 
the disturbance caused on its action. In other words, we 
cannot estimate an unknown quantum dynamics without 
perturbing it. Therefore, it is important to find a quanti- 



tative formulation of the information-disturbance trade- 
off, and to find the optimal scheme that introduces the 
minimum amount of disturbance for any given amount of 
extracted information. Like the trade-off for states, the 
trade-off for transformations is relevant to the discussion 
of quantum cryptographic protocols where the secret key 
is encoded in a set of transformations, as it happens in 
the two-way protocols of Refs. [l7l - [l9| for finite dimen- 
sional systems, and in the protocol of Ref. [l^l for con- 
tinuous variables. Here for simplicity we will restrict our 
attention to the case of unitary transformations on finite 
dimensional quantum systems. Like in Refs. 0, fllj we 
will quantify the information gain and the disturbance 
with suitable fidelities, and we will derive the minimum 
amount of disturbance associated to any possible value 
of the information gain. 

The paper is structured as follows: in Section |ll] we 
introduce the problem and the notation. Section IIIII 
then provides a brief review of the formalism of quan- 
tum combs and generalized instruments (2l| - [23| . which 
is crucial in our paper. The complete analysis of the 
information-disturbance trade-off for arbitrary unitary 
transformations will be presented in Section llVI in par- 
ticular, we will first give the rigorous mathematical for- 
mulation of the problem (Subsec. IIV Al ). the analysis of 
its symmetries IIVB| the derivation of the optimal trade- 
off curve (|IV Cp . and, finally, the construction of the op- 
timal network (jlVDI) . We conclude the paper with a 
discussion of the results in Section |Vl 



II. PRELIMINARIES AND NOTATION 

In the case of states, the mathematical tool to an- 
alyze the information-disturbance trade-off is provided 
by the notion of quantum instrument. In the discrete- 



outcome case, a quantum instrument is a set of quantum 
operations (trace-decreasing completely positive maps) 
{Ti} transforming operators on the input system Hilbert 
space 'Ho to operators on the output system Hilbert space 
Jii, with the normalization condition that T '■— ^^71 is 
trace-preserving (that is, it is a quantum channel). A 
quantum instrument describes a measurement process 
that outputs the classical outcome i and the quantum 
state Ti{p)/Ti[Ti{p)] with probability pi = Tr[7;(p)]. To 
derive our results we will use the generalization of the no- 
tion of instrument to measurement processes on quantum 
transformations, rather than on quantum states [2l| - |23| . 
This extension will be presented in Section IIIII 

In the following we will denote the linear operators on 
a Hilbert space H by L{H). We will make extensive use 
of the isomorphim between linear operators in L{'H) and 
vectors in 71®% given by 

A^Y^ {n\ A \m) \n) (m| ^ \A)) = ^ (n| A \m) \n) \m) 

nm. nm 

.(1) 

where {\n)} is a fixed orthonormal basis for H. The iso- 
morphism satisfies the property 

\A)) = iA®im^ii®A^m (2) 

T denoting transposition with respect to the fixed basis. 
For the sake of clarity we will often use the notation 'Ha,b 
to denote the tensor product Ha^^'Hb, ^o,b to stress that 
A belongs to {Ha,b), and, similarly, \tp)g_ and \-Afja,h to 
stress that \ip) belongs to Ha and \AJ) belongs to 'Ha,b- 

Using the Choi isomorphism , we can associate each 
completely positive map Ti '■ L{'H^) — >■ L{'Hi) with a 
positive operator Xi £ L{Hi®'Hq) given by 

= (7;$5lo)(|/))((/|o,o) (3) 

Iq being the identity map on "Ho- 

In terms of the Choi operator, the condition that T is 
trace-preserving (resp. trace-decreasing) becomes 

Tri[T]-/o (reps.Tri[r]</o) (4) 

where Tri denotes partial trace over 'Hi. 

We now introduce the trade-off problem for quantum 
transformations. Consider a quantum network TZ with 
an empty slot that can be linked with a variable quan- 
tum device, the input-output action of the latter being 
described by a channel in the set Ideally, we would 

like the network TZ to give us some information about the 
channel £i without affecting the output state £i{p) that 
the channel should produce when an input state p is fed 
in the corresponding device, (see Fig. [1]). However, as 
already mentioned, this is not possible in general. 

As we already mentioned, there are two extreme sit- 
uations. On one extreme, if we are only interested in 
extracting information, the best strategy is to apply the 
channel on one side of a suitable bipartite state a € 
L{Ho ® "Ho), thus getting the output state {£i ®Xq){(j), 
and then to perform a suitable measurement {Pj}- In 
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FIG. 1. Given a black box implementing an unknown channel 
£i drawn from a set we want to link it with a quantum 

network TZ that both gives an estimate j of the parameter i 
and affects the output state £i{p) as little as possible (here 
the symbol ~ means that the network TZ is optimized in such 
a way that the output of the two circuits on the left and on 
the right is as close as possible). 



this case the available use of the channel is consumed for 
estimation: after this step, the best we can do to pro- 
duce an output state close to £i{p) is to apply to the 
input state p some channel £j that depends on the out- 
come j of our measurement. On the opposite extreme, 
if we do not tolerate any disturbance, the only possible 
is to apply the black box to the input state p. In this 
case we correctly obtain the output state £i{p), but we 
have no measurement data to infer the identity of the 
unknown device. In the intermediate cases, it is impor- 
tant to assess the maximum amount of information that 
can be gathered without trespassing a given disturbance 
threshold. 

Since the trade-off problem involves optimization of 
quantum networks, we will use the approach of quantum 
combs developed in [2T| - [23| . This approach is based on 
the characterization of the most general transformations 
that quantum channels can undergo, and on realization 
theorems proving that all these abstract transformations 
can be implemented by quantum networks. Since our 
theorems are constructive, this approach will also provide 
the explicit form of the optimal quantum network. 



III. QUANTUM COMBS AND GENERALIZED 
INSTRUMENTS 

By stretching and rearranging the internal wires, we 
can give to every quantum network the shape of a comb. 
The empty slots of the network becomes the empty space 
between two teeth of the comb. 
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FIG. 2. A quantum comb with N + 1 teeth. The flow of 
quantum information is from left to right. The input wires 
of the network are labelled with even numbers from to 2A'', 
the output wires with odd numbers from 1 to 2N + 1. 



3 



Referring to Fig. [2l each wire is labeled with a natural 
number, which is even for the input wires and odd for 
the output ones; the corresponding Hilbert spaces are 
labelled accordingly. 

If our network consists of a sequence of N quantum 
channels (trace-preserving maps), then we call it deter- 
ministic. To every deterministic network we can asso- 
ciate a positive operator i?'^' > 0, call ed q uantum comb, 
satisfying the normalization condition [2TI [23l. [26j 



Tr 



2fc-l 



2fe-2 



(fe-i) 



k = l,...,N, (5) 



where = 1, e L{Houty, <E) HmJ with Hin^ = 

<S>t=l '^2n and Houtk = 0^=0 '^2n+i, IS the comb of the 
reduced circuit obtained by discarding the last N — k 
teeth. 

The normalization condition of Ec^. ^ reflects the 
causal ordering in the deterministic network. We will call 
a comb satisfying Eq. ([5]) deterministic, and we will de- 
note by DetComb({^^^Q ^ Hi) the set of all deterministic 
combs with the given ordering of the input and output 
spaces. A deterministic quantum comb with A'^ = 1 is 
simply the Choi operator of a quantum channel: in this 
case the condition of Eq. ([S]) is equivalent to the nor- 
malization of the channel given in Eq. Accordingly, 
DetComb(?^b (g) Ha) will be the set of (Choi operators of) 
quantum channels from L{'Ha) to LlJih). 

This framework of quantum combs can be easily ex- 
tended to the case of networks consisting of quantum 
operations (trace-decreasing maps). We call probabilistic 
comb a positive operator 5'^) > that is bounded by 
some deterministic comb, that is, an operator S**-^' with 
the property 



C2N-1 \ 
Hk such that S'^^'> R^^'> 
k=0 ) 

(6) 

We will denote by ProbComb(0^^Q'"^ "Hfc) the set of all 
probabilistic combs with given ordering of the input and 
output spaces. A probabilistic comb with A^ = 1 is sim- 
ply the Choi operator of a quantum operation: in this 
case the condition of Eq. © is equivalent to the bound 
in Eq. (g]). Accordingly, ProbComb('H6 ® Ha) wih be 
the set of (Choi operators of) quantum operations from 
L(Ha) to LCHb). 



Two quantum networks 72,(^) and S^^'' can be linked 
together by connecting some wires of 7?.^^^ with some 
wires of . Let us denote by J the set of wires that are 
connected and by K (L) the set of wires of 7?.*^^^ (S^-^) 
that are not. The circuit resulting from the connection, 
denoted by T?.'^-* * S''^^\ has Choi operator given by the 
link product 

rW . S^'n ^ Trj [(4^; ® /l) (/k ^i;^^^^] , (7) 

where R'^^\S'^^^^ are the Choi operators of T?,^^) and 
g{M)^ respectively, and Tj denotes the partial transposi- 
tion with respect to the fixed orthonormal basis of Eq. 
dD). For example, let f be a channel from Ho to Hi and 
J" be a channel from Hi to H2', then the Choi operator 
of the composition J^£ is 



F*E^Tri[{F2,i(g,Io){l2 



(8) 



As a particular case for Ho ~ C, if p is a state on Hi 
and f is a channel from Hi to H2 one has 



£{p) = E21 * pi = Tri[£;2i(/2 <E) pj)]. 



(9) 



A deterministic (probabilistic) quantum comb, besides 
representing a quantum network with some empty slots, 
can also represent a quantum channel (operation) TZ^-^^ 

bouiHeven := (8>fc=o^ ^2fc toHodd ■= (8>fe=o^ '^2fc+i ■ E)ue 
to the Choi isomorphism, the channel 7?.^^^ is in one-to- 
one correspondence with the comb R^^\ In the follow- 
ing two subsections we will exploit this correspondence to 
discuss the physical realization of quantum combs, both 
in the deterministic case (subsec. IIII Ap and in the prob- 
abilistic case (subsec. IIII Bp . 



A. Realization of deterministic combs 

The following theorem, proved in Ref. [13] , gives an ex- 
plicit construction for the realization of every determin- 
istic quantum comb as a sequence of isometric channels. 



Theorem 1 (Realization of deterministic combs) 

Every deterministic comb can be realized as a concate- 
nation of isometric channels in the following way: 
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2N-2r 



-SN-l 



(10) 



2Ar-5 



2N-1 



where Ak is an ancilla with Hilbert space Ha,, Vl'^l : L{H2k-2 <S) Ha^^J «s the channel defined by VW(p) = 
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isom- 

etry : ^2^-2 <8) l-LAk-i "^2^-1 (8) "Ha^, and repre- 
sents the partial trace on Han ■ Precisely, the ancillary 
Hubert spaces HAk-n^Ak are defined by Haq '■= C and, 



fork>l and Ha, ■= Supp(i?('=)*) C {g),^,to^ H™, where 
Supp(i?('^-'*) denotes the support of the complex conjugate 
of i?^'^'' in the fixed basis. The isometry V^'^^ is given by 
the expression 



V^'^ :-U2.-i^[(V-i)',...,0' 

X (l^))(2fc-l),(2fc-l)' 



(fe)* 



(2A:-l)',(2fc-2)' 



R 



(fc-i)* 

(2fe-3)',...,0' 



(2fe-2)'^(2fe-2) <&* -'(2fc-3)' 



'lo' 



(11) 



where Hk' — Ti-k and T„ 



the teleportation operator 



from Hn to Hm, given by Tm^-n = Z]fe l^)m (^U 

Note that the isometry V^^^ defined in Eq. (fTTj) has 

the correct input and output Hilbert spaces. Indeed, for 

fc = 1 one has i?'^"^ — 1 and the isometry V^'^\ given by 
-1 

^[11 = h® (i?l}.o* ) ' ® To^o'). sends vectors 



in Ho to vectors in Hi <g) Hai , where Hai ~ Supp(i?J^^^J,) 
is a subspace of "Hi' ® Ho' ■ For fc > 1, since V-Ak-i — 

Supp(i?|2j~-'^3)* 0') ^ subspace of 'H(2k-3)' ® • • ■ ^ "He , 
the isometry ^1*^1 sends vectors in 'H2k-2®'HAk-i to vec- 
tors in H2k-i (8) HAk , as stated by the thesis. 



Pi- {Pi} is a quantum measurement on the ancilla Aiq , 
described by the POVM 



P, = 



(13) 



In our study of the information-disturbance trade- 
off we will use generalized 2-instruments, which can be 
graphically represented by combs with two teeth and one 
empty slot where the unknown black box can be inserted, 
as in Fig. [T] Since the value of N is fixed to A'' = 2, in the 
following we will drop the index (N) in R^^^ and i?^^) 
and simply write Ri and R. 



B. Generalized N-instruments 



IV. INFORMATION-DISTURBANCE 
TRADEOFF FOR UNITARY CHANNELS 



In the discrete-outcome generalized N- 

instrument is a set of probabilistic combs C 
ProbComb({^^^Q ^ T-Lk) satisfying the normalization con- 
dition 

2N-1 

-R(^) ■.= ^R^e DetComb( Uk)- (12) 

i k=0 

When N = 1 the notion of generalized instrument co- 
incides with the usual notion of quantum instrument. 
Every iV-instrument can be realized as a quantum net- 
work, due to an analogue of Ozawa's dilation theorem 
(29} . The proof of the dilation theorem for generalized 
TV- instruments was originally presented in Ref. [IJ , and 
is combined here with Theorem [TJ 

Theorem 2 (Realization of A^-instruments) 

Every generalized N-instrument {Ri^^} C 
ProbComb(0^^Q"^ "Hfc) can be realized as a quan- 
tum network of isometric channels followed by a 
measurement one the last ancilla, as follows: Here Ak, 
Ha,, and are the ancillas, the Hilbert spaces, and 
the isometrics providing the realization of the determin- 
istic comb R^^^ = RI^\ as given by Theorem \^ 
represents the partial trace on Han with the operator 



A. Formulation of the problem 

Suppose that a black box performs an unknown uni- 
tary channel W(/9) ~ U pU\ where the unitary U € SU((i) 
is randomly drawn according to the normalized Haar 
measure AU . Let Hi ~ 7^2 — C'' be the input and 
output Hilbert spaces for the unknown channel, respec- 
tively. In order to extract information we will then use 
a quantum network like that of Eq. ([T^ with N — 2. 
The network will be the described by a generalized 2- 
instrument {Rjj}, the outcome U € SU((i) being the es- 
timate of the unknown parameter U. For every possible 
outcome (j, Rjj is an element of PrabComb(0^^p "Hfc)}, 
with ~ Hi ~ 'H2 — Hz, and one has the normaliza- 
tion condition 

3 

R := dJ7i?^ e DetComb((9)?ife), (14) 

Jsa(d) 

which is the continuous version of Eq. (IT^ . Since there 
will be no ambiguity, from now on we will omit the do- 
main of integration SU((i). 

When the unknown black box with channel U is con- 
nected to the quantum network with generalized instru- 
ment {TZjj}, one obtains a set of quantum operations 
TZfj * U, each corresponding to a possible result of the 
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measurement. However, to speak about the "the proba- 
bihty of the outcome [/" we need to know what input 
state p is fed in the circuit: we cannot speak of the 
"probabihty of a quantum operation" without specify- 
ing its input state. If the input state is /? G L('Ho), then 
the probabihty is given by the trace of the output state 

p{U\U,p) ^TiiiTZ^* U){p)] 

= Tr[R(j{h^\U*)){{U*\2,i^P*o)], (15) 

where we used the Unk product of Eq. ([7]) and Eq. © 
to compute the Choi operator of TZ^y * U and the action 
of the channel TZjj *U on the state p, respectively. We 
also used the fact that — A* for every self-adjoint 
operator. 

To quantify the information gain and the disturbance 
we now introduce two suitable fidelities. Suppose that 
the black box performs the unitary channel U and that 
the measurement outcome is U. In this case we quantify 
information gain with the fidelity 



9{U,U)^^\Tt[UU^]\' 



(16) 



Note that the maximum value of the fidelity is 1, and is 
achieved if and only if t/ = wt/ for some phase |a;| = 1, 
that is, if and only if the two unitary channels U and 
U coincide. The fidelity g(U, U) enjoys the invariance 
property 

g(U^ U) = g{VUW, VUW) Vy, W e §V{d). (17) 

Averaging the fidelity with the probability of the estimate 
U given the true value U and the input state p, we then 
obtain the average information gain 



Go 



dU / AUp{U\U,p)g{U,U). 



(18) 



In our analysis we will always assume that the input state 
is given by p = I /d. The reason for this choice is that 
the condition p = I /d arises in two relevant scenarios: 

1. when the input system (wire 0) of the circuit is 
prepared in a maximally entangled state with some 
reference system 0'. This is the case in the cryp- 
tographic protocols of Refs. [13, [3 (and, in the 
infinite energy limit, also in in the continuous vari- 
able scenario of Ref . ) . 

2. when the input system is prepared at random in 
one of the states of an ensemble with the 
property that J^iPiPi — ^/^- This is the case of 
the cryptographic protocol of Ref. [l^ . 

Since we are setting p ~ I /d, we will drop the subscript 
p in Gp. Using Eqs. (fT5)) and p6|) . the expression for the 
information gain G is 



G=l jdU I AUTr,MU*\2sRu\U*))2M{U\UW 



We now introduce our figure of merit for the minimiza- 
tion of the disturbance. To this purpose, we consider the 
channel fidelity [l^ between the overall quantum oper- 
ation TZ^ * U performed by the network and the input 
channel hi. This is the fidelity between the two output 
states produced by the two operations TZ^j * hi and hi 
when applied on one side of the maximally entangled 
state 1$)) = -^|/))o o'. In terms of Choi operators, the 
channel fidelity is given by 

F{n(j*u,u) - jj((t/|3,o {Rfj * m{{uu,i) \u)h,o 

= ^{{U\3AiU*kiRo\UhM\U*h,u 

where we used the fact that, by definition of Choi opera- 
tor (Eq. ©), one has {£ <^I){\^)){{^\) = E/d for every 
quantum operation £. 

Averaging over the outcomes and the true values we 
then obtain the average fidelity 



I I dU{{U\3.o{{U*\2.iRfj\U))3.o\U*h,i 



ldU{{U\3,o{{U*\2,lR\U))3,o\U*))2,l. 



(20) 



Note that the fidelity F naturally arises also in the 
case where the input state at the wire is a pure state 
(p = \ip) {ip\ chosen at random according to the uniform 
measure on pure states: in this case the fidelity between 
TZ^ *hl{ip) and hi{ip), averaged over (p, U , and U , is given 
by 



F' = I dip J dU J dC/Tr[(C/(^C/^) {Ujy^U) (ip)] 

dip [dU [ dUTr[{R^ ^ \U)){{U\2,i) {UpU^ ® ip*)] 



^ J dip J dU{U^\,{{U*\2,i{^*\oR\Uip),\U*h,i\ip*)o 
= / du(^-^F{TZ*U,U) + 



d{d+l) 
'-F- ' 



Tii{{U*\2sR\U*h,i 



d+1 d+1 
having used the relation 

d(p(p ® ip* 



d{d+l) 



(21) 



(19) 



and the normalization Tr[R] = d^ , which follows directly 
from Eq. (0 in the TV = 2 case with Ha ~ ^.2 ^ ^2 ^ 
Ho ~ C^. Since there is a trade-off, the information 
gain G and the fidelity F cannot achieve their maximum 
values at the same time. Therefore, we will introduce a 
weight < p < 1 that quantifies how much we care about 
information extraction versus disturbance minimization, 
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and our figure of merit will be the convex combination 
pG+ {l—p)F. The extreme case p = and (resp. p = 1) 
corresponds to the situation where we do not tolerate 
any disturbance (resp. where we are only interested in 
extracting maximum information). The trade-off curve 
obtained by the maximization of pG + (1 — p)F for all 
possible values of p G [0,1] is the same curve that would 
be obtained by maximizing F for given G (i.e. by finding 
the minimum disturbance for given amount of extracted 
information), or by maximizing G for given F (i.e. by 
finding the maximum amount of extractable information 
for given disturbance threshold). 



B. Symmetry of the estimating network 

Here we exploit the symmetries of the figure of merit 
pG+ {l—p)F to simplify the optimization problem. The 
crucial simplification comes from the following Theorem, 
which states the symmetry properties of the optimal gen- 
eralized instrument: 

Theorem 3 (Symmetries of the optimal instrument) 

Let G and F be the information gain and the fidelity 
defined in Eqs. I119\) and i20\) . For every p e [0,1], the 
generalized instrument that maximizes pG -|- (1 — p)F 
can be chosen to be covariant, that is, of the form 



the substitution {Riy} — > i^'u^ '-■^^ ^® done for every 
generalized instrument, in particular it can be done for 
the optimal one. I 

Using Theorem [21 we can now express the normaliza- 
tion condition of Eq. (I14p in a particularly simple way. 
Indeed, Eqs. and (1^^ imply that the normalization 
operator R = JdU Rfj satisfies the commutation relation 

The Schur lemma then implies Tr3[i?] — I2 ® R^'^'' 
for some positive operator i?'-^) G ^('Hi 'Ho), and 
Tri[i?(i)] = alo for some positive number a G R. There- 
fore, the normalization condition for i? to be a deter- 
ministic comb (Eq. ([5]) for iV = 2) becomes trivially 
Tr[i?] — d^, or, equivalently. 



Rjj 



{UsfEiU; ®Ii,o)(S), 



(22) 



for some positive operator 5 G L{H3 (8) 7^2 (8) Hi (8) "Ho). 

Moreover, the operator S satisfies the commutation re- 
lation 



[S, (8 (8 Fi 8) Fo* 







yV e §U(d). (23) 



Proof. The proof is based on the same argument used 
for the proof of Lemma 2 in Ref . [2^ . Consider an ar- 
bitrary generalized instrument {Rjy}. Using the invari- 
ance of the Haar measure and of the fidelity g{U , U) (Eq. 
([TT])'). it is easy to check that the values of F and G in 
Eqs. and (PO)) do not change if each Rfy is replaced 
by the group average 



R'^ := j <WAW{Vz (8 



Wi®Wo*)(i?^tc/v^), (24) 



where V ,V*, W, W* are the unitary channels correspond- 
ing to the unitaries V, V* , W, W* , respectively. Note that 
is still a generalized instrument, because it satisfies 
the normalization condition of Eq. (|14p . Moreover, from 
Eq. (p4)) is is clear that E :— R'j satisfies the commuta- 
tion relation of Eq. (^5)) . Finally, from Eq. (1^ it is also 
clear that for every U,V,W G SV{d) one has 



R[ 



VUWf 



(V3 8)V2*8)Wi8)Wo)(^r7 



Taking U = W = I one then obtains Ry = (V3 8) V2* ® 
Ii.o)(5), namely R'~ is of the form of Eq. (P^ . Since 



Tr[S] = d^ 



C. Optimal trade-ofF curve 



(25) 



Exploiting Theorem [3] and the Schur's lemmas we can 
now rewrite the figure of merit as: 

pG+{l- p)F = Tr[(MG + (1 - p)Af)S] (26) 

where Aq and Ap arc the positive operators given by 

1 



A, 



Ac 



[^3,2,1,0 + 
13,2 



d^P:- 



d2(rf2 _ 1) 
- ^3,2 <8 /l,0 

i(/3(8Tr3,o[AF]<8/o) 



3,2 



1 



1 



d2(d2- 1 



(27) 



(28) 



P — d^^\IJ){{I\ being the projector on the one- 
dimensional invariant subspace oiV ®V* . 

Since the only restrictions on S are positivity and the 
normalization given by Eq. (|25p . the optimal choice is 
to take S proportional to the projector on the eigenvec- 
tor of pAq -\- (1 — p)Af corresponding to the maximum 
eigenvalue; up to normalization, this eigenvector the can 
be shown to be of the form 

Ix) =x|/))3.o|/))2,i+y|/))3,2|/))i,o, x,y€M+ (29) 



In order to satisfy Eq. (P5)) . we then choose S = |x) (x| 
with the normalization (xjx) = ■ Reminding Eq. 
we get 

\xij) ■■= x\U)):i^n\Ul)2s + y|/))3,2|/))i,o. (30) 

The normalization of x implies that x and y obey the 
quadratic equation 



V 



2xy 



= 1 



(31) 



Note that in the above equation there is just one free 
parameter (either x or y), which can be expressed e.g. as 
a function on the trade-off ratio p. Fidehty and gain can 
be calculated in terms of the parameters x and y, thus 
getting the following expressions 



The corresponding plot is showed in Fig. O 



F = 1 



G 



y 



(32) 



The extreme situation of minimum disturbance (resp. 
maximum extraction of information) can be retrieved in 
the extreme case x — Q,y = 1 (resp. y — l,x = 0). 
Indeed, when x — Q,y = 1, one has Rjj = |/))((/|3,2 ® 
|J))((/|i^o for all U. In this case, there is no informa- 
tion extracted and one has TZjy * U = U, that is, the 
instrument realizes the identity map. Accordingly, the 
fidelity F reaches its maximum F — 1, while the in- 
formation gain takes its minimum G = the value 
achieved by a random guess according to the Haar mea- 
sure. In the opposite case x = l,y = one has in- 
stead R^j \U)){{U\3.fi ® \U*)){{U*\2S, which implies 
TZ(j *U = \ Tr[UW]\'^U. This means that in this case 
our circuit performs the optimal estimation of U psl j. 
and then executes the transformation U on the input 
state. Accordingly, the fidelity drops to its minimum 
value F = and the information gain reaches its maxi- 
mum G = 

Following Ref. jTl| we introduce now the information 
variable < / < 1 and the disturbance variable < D < 
1, given by 



/ := 



G — Gr. 



Gn 



Gn 



D 



F 



F„ 



where G^ax = S/d^, G„„;„ = F,nin = 2/^^ and 

Fmax — 1. Note that I — (D = 0) corresponds to 
no information (no disturbance) and / = 1 (_D = 1) 
corresponds to maximum information (maximum distur- 
bance). 

Using Eq. (|32|) and the definitions of / and D it is 
immediate to obtain the relation 



x^\/D 



y 



= x/W. 



(33) 



Substituting the above equation in the normalization 
condition of Eq. ((3T|) we finally obtain the curve of the 
optimal trade-off: 

(f{D-I)^-AD{l-I)=0, (34) 



D. Optimal quantum network 

We now use Theorems [T] and [2] to construct exphcitly 
the optimal network achieving the trade-off of Fig. |3l 
The optimal network will be derived for every possible 
value of the parameters x, y with < x,y < 1 belonging 
to the curve x'^ + y'^ + 2xy/d = 1. Since x and y can 




FIG. 3. Plot of the minimum disturbance D{I) as a function 
of the information / (Eq. (|34|) '). for various values of d; d = 2 
solid line, d = 3 dashed line, d = 4 dotted line 



be easily expressed in terms of the information / and the 
disturbance D (Eq. ([33])), our construction provides the 
optimal network for very point in the optimal trade-off 
curve depicted in Fig. [31 

According to Theorem [5] the generalized instrument 
{Rjj} is implemented as a sequence of A'^ = 2 isometrics 
^[11 : -Ho ^ -Hi ® and V^I^] • (g) nA^ -> «) Ha^ , 
followed by a measurement {Pjj} on the ancilla A2. The 
ancillary Hilbert space Hai (^^2) is given by Hai = 
Supp(i?^}_^o*) c Hv ®Ho' {-Ha, = Supp(i?;, 2, ^, 0,) c 
V-s' iX) 7^2' (8) "Hi' (g) Ho' ), with Tik' — Hk The isometrics 
y['A are obtained from the realization of the deter- 
ministic comb R — J dURjj (Theorem [1]) and the ancilla 
measurement is given by the POVM 



Pf, = {R*) ^* R} {R* 



(35) 



Let us start from the construction of the isometrics. 
By explicit calculation we find 



R 



J-^ + y^d^ + 2xyd] (P3.2 ® Pi,o)- 



(^3,2,1,0 - ^3,2 Il.O ~ h.2 ® Plfl)- 



d2 - 1 



Taking the partial trace on 'H3 and using the condition 
Tr3[i?] = h® i?^^^ we then obtain 

i?W = ^^^A,o + ^(/-P)r,o, 



and, therefore. 



=—{ydPis) + xh^0) 



(36) 



(.T + yd) ' X 
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According to Eq. ([TT|) . the isometry V^-^^ : Ho Hi 
Hai C "Hi^i'^o' is given by 



^[1] = 



h 



(|/))i,i"»ro.^o) 



— (yTi^o® |/))i',o'+a;|/))i,i' 



If we input a pure state 
superposition 



e Ho the output is then the 



-^|V)J/))r,o' + ^|/))M' H)o' 



Intuitively, we can understand the action of Vi as a su- 
perposition of two different processes: 

1. with amphtude y the quantum state 1-0)0 is propa- 
gated undisturbed from the input system to the 
output system 1, so that the unknown unitary U 
can act on it. As we will see in the following, 
the maximally entangled state |$))i',o' = -^\I})i'.,o' 
will then serve as a resource to teleport the state 
U\ip)2 to the output node 3. 

2. with amplitude x the state {tpjo is transferred to 
the ancillary degree of freedom 0': in this case 
the unknown unitary will not act on it, but, in- 
stead, it will act on the maximally entangled state 

thus producing the state 

\^u))2.i' — ^\U)2i'- As we will see in the fol- 
lowing, the state |$c/))2,i' will be used for the opti- 
mal estimation of U. Finally, the state \iI')q, will be 
transferred to the output system 3, and, depending 
on the estimate, a transformation U will be applied 
on it. 

The isometry V^^^H2,i',o' ^H2<E) Ha, -> "Ha ® Ha2 ^ 
^3,3',2',i',o' is given by: 



X (|/»3,3' 



(^3',2',1',0' 



h',2' 

h',0') 



(38) 



On the other hand, using Eqs. (|35j) and ^ the POVM 
{Pfj} on "Has can be written as 



Pu-\vu){vu\ \vu) ■■= (RT^ \xh) 



(39) 



Combining the isometry yl^l with the POVM {Pjy} we 
then obtain the instrument {7^}, with 7^ : L{H2 <^ 
HA2) ^ L{n3) given by 



^P^L{n2(it)nA,] 



We now use Eqs. (pS)) and to show that the in- 
strument {Tfj} has a very simple form. To construct Tfj 



explicitly we start from the Kraus form 7^ (p) = KjjpKl, 
where the Kraus operator is given by 

Ku = ih^{Vu\3'^2',l',,')V^'^ 

X (|/))3,3' «)72'^2 «)/l',0') , 

having used Eqs. §^ and Now, from Eq. §0^ 



we have ( xjj 



3',2',1',0' 



(^l3',2',l',0' ( 



and, therefore 

Kr-r = (4 ® (X|3',2M',0') (^3 » 73,,2' « 
'\Uh.3' (E)UIT2'^2^Ii',0' 



Finally, inserting Eqs. p9)) and ([37)1 in the above expres- 
sion we obtain 



^ UsT^^o' 

which implies that the instrument {7^} is given by 
T^{p) = U^n^o' (d{{U\2,vp\U))2.i') To^^aUl (40) 



where we introduced the redundant notation To'^3 := 
Tg^Q, = J2n=i l'^)o' ("I3 = 7o'^3, to make the expression 
clearer. 

The interpretation of Eq. (^(1)) is straightforward: to 
implement the instrument {Tjj} we only have to perform 
on system 2 and on the ancila 1' the Bell measurement 
{B(j} with POVM = d\U)){{U\, and, depending on 

the outcome, to perform the unitary U on the output 
system 3, which is obtained from the ancilla 0' just by 
relabelling (represented here by the teleportation oper- 
ator Ta^-o')- In other workds, the instrument {7^} is 
just obtained by a Bell measurement followed by uni- 
tary feed-forward. Remarkably, {7jy} is independent of 
the trade-off parameters x,y: this means that, after we 
performed the isometry V^^\ the remaining part of the 
optimal network is independent of the particular value 
of the information-disturbance rate. The reason for this 
is that the combination of Bell measurement and feed- 
forward realized by the instrument {Tjj} can work both 
as a teleportation protocol (in the case of no-disturbance) 
and as an estimate-and-reprepare strategy (in the case of 
maximal information extraction). 

To summarize the results of this section, we give now 
the step-by-step evolution of a pure state \ip)o in the op- 
timal quantum network: 



Wo ^ ^{yWi\i))i',o' + 
1 



Vd 

Vd{{u\ 



— (yUW2\I))l',0'+x\U))2, 



l^)o') 



> yU^U\ 



xTr[UU^] |V')3 



yU\tp)^ + xTi[UU^]U\ 
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u 



r 

0' 




FIG. 4. Optimal quantum network for the information- 
disturbance trade-off. The input state enters from the 
wire 0. Then, the isometry y'^' prepares a coherent super- 
position (y l-'^))i',o' Wo') which is tuned by 
the parameters x = y/D and y = \/l — I, whose value depend 
on the information-disturbance rate. After that, the unknown 
unitary U is applied between the nodes 1 and 2 of the network. 
Finally, a Bell measurement is performed and, depending on 
the result, the unitary transformation U is performed on the 
output system 3. 



The action of the whole network is depicted in Fig. 2] 



V. CONCLUSIONS 

In this work we addressed the fundamental problem of 
the information-disturbance trade-ofF in the estimation of 
an unknown quantum transformation. In particular, we 
completely solved the problem in the case of a unitary 
transformation, randomly distributed according to the 
Haar measure. 

Interestingly, the analytical expression of the optimal 
trade-ofF curve given in Eq. ([M)) ) happens to coincide 
with the trade-off curve for the estimation of a max- 
imally entangled state fll|. Note, however, that this 
is not a trivial consequence of the Choi isomorphism 
U ^1^)' ''^hile this mathematical correspondence 
is one-to-one, operationally it cannot be inverted with 
unit probability. In other words, once the transforma- 
tion U has been applied to the maximally entangled state 
-^|/)), it is irreversibly degraded, and can be retrieved 
only probabilistically. For this reason, there is no op- 
erational relation between the information-disturbance 
trade-off for unitary transformations and that for max- 



imally entangled states (none of them is a primitive for 
the other). Indeed, the optimal quantum network for 
unitary transformations depicted in Fig. |4] is quite dif- 
ferent from the optimal network for maximally entangled 
states. In our case the optimal network consists oi i) a 
first interaction that produces a quantum superposition 
with amplitudes depending on the desired information- 
disturbance rate and ii) of a Bell measurement followed 
by unitary feed-forward. 

Besides its fundamental relevance, the information- 
disturbance trade-off for transformations is also inter- 
esting as a possible eavesdropping strategy in crypto- 
graphic protocols where the secret key is encoded in a 
set of unitary transformations, as it happens in the two- 
way protocols of Refs. (17h20| |. Notice, however, that 
for protocols where the secret key is encoded in a set of 
orthogonal unitaries, like those of Refs. [l^! EE, US] : the 
security of the protocol is not based on the information- 
disturbance trade-off studied in this paper. Indeed, since 
the unitaries are orthogonal, they can be estimated and 
re-prepared without introducing any disturbance (or just 
introducing a vanishing disturbance, in the infinite di- 
mensional case). This is the reason why the protocols of 
Refs. [13, 0, [13 necessarily require the random switch- 
ing between a communication mode and a control mode. 
The present analysis is instead relevant for the analy- 
sis of the two-way protocol of Ref. [l^, which uses 
two mutually unbiased bases of orthogonal qubit uni- 
taries, given by Bi = {fT^})l=o ^^d B2 = {U(Tf_L}l=o, 
where cto = /, {<^k}k=i ^^'^ the three Pauli matrices, and 
U = (-^ + *X]fc=i ffc)/2 is the rotation of 27r/3 around the 
axis n — 1/a/3(1,1,1). In this case, using the optimal 
network is a non-trivial eavesdropping attack. Of course, 
since the protocol does not involve all possible qubit uni- 
taries, the optimal trade-off curve for the restricted set 
Bi U B2 could possibly be more favourable to the eaves- 
dropper than the universal trade-off curve derived in this 
paper. The analysis of the trade-off for non-universal sets 
of unitary transformations and the study of the relations 
between information-disturbance trade-off and quantum 
cloning for unitary transformations [l9| are interesting 
directions of future research. 
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